There is no enforcement because if GDPR claims that it has jurisdiction over entities not having physical presence in the EU, then the law isn't lawful to begin

There is no enforcement because if GDPR claims that it has jurisdiction over entities not having physical presence in the EU, then the law isn't lawful to begin with. And if the EU started going after companies/individuals who don't have presence in the EU because they claim "we say so", well, then the rest of the world can play that game to. Maybe the rest of the world will put sanctions on EU bureaucrats if EU bureaucrats start trying to shake down companies that have no presence in the EU.